Hiring: Cloud Security / AI Security Engineer | AWS IAM & Cedar Policies | Remote | 15+ Years

Technology Management Solutions LLC; Myrtle Point (OR); Remote; USD 103,000 - 172,000; Part time

Job summary

Technology Management Solutions LLC seeks a Cloud Security / AI Security Engineer to secure enterprise AI apps on AWS. The role emphasizes IAM policy templates, Cedar-based authorization, and secure access to tools and APIs. Remote work with occasional travel to client sites is required.

You will implement RBAC/ABAC, automate policy deployments, and participate in security governance across DevSecOps pipelines. 15+ years of expertise are expected.

Qualifications

• 15+ years of security engineering experience in cloud identity and access management.
• Strong knowledge of IAM, RBAC, ABAC, and least privilege.
• Experience designing reusable IAM policy templates across AWS services.
• Proficiency with Cedar policy language and Bedrock-based authorization.
• Experience with CI/CD security, IaC (Terraform, CDK, CloudFormation).

Responsibilities

• Design and maintain reusable IAM policy templates for AI agents and infrastructure.
• Implement RBAC/ABAC and trust policies with audit and reviews.
• Develop Cedar authorization policies and enforce tool access controls.
• Automate policy deployment via GitHub Actions and IaC pipelines.

Skills

RBAC

ABAC

IAM Policy Design

Cloud Security

DevSecOps

Tools

Terraform

AWS CloudFormation

AWS CDK

Bedrock

Cedar policy language

Python

GitHub Actions

AWS CloudTrail

CloudWatch

Secrets Manager

Job description

Hiring: Cloud Security / AI Security Engineer | AWS IAM & Cedar Policies | Remote | 15+ Years

• Contract

Location: Los Angeles, CA(Remote – 10% Travel; must be comfortable traveling to client sites for workshops and meetings)

Duration: 3+ Months (Extension Possible)

Primary Skills: IAM Policy Templates, Cedar Policies

Role Overview

Seeking an experienced Security Engineer with 15+ years of experience in cloud security and identity management to secure enterprise AI applications on AWS. The role focuses on authentication, reusable IAM policy templates, Cedar-based authorization, and secure access to tools, APIs, and enterprise resources.

Key Responsibilities

1. IAM Policy Templates & Access Management

• Design, develop, and maintain reusable AWS IAM policy templates for AI agents and AgentCore infrastructure.
• Implement role-based access control (RBAC) and least-privilege security principles.
• Define IAM roles, trust policies, permission boundaries, and resource-based policies.
• Configure IAM execution roles for AgentCore Runtime and AgentCore Gateway.
• Develop standardized IAM templates for accessing AWS services such as Lambda, S3, Bedrock, API Gateway, Secrets Manager, and CloudWatch.
• Automate IAM policy deployment and configuration using Terraform, AWS CloudFormation, or AWS CDK.
• Conduct IAM access reviews, permission audits, and policy validation.
• Troubleshoot access-denied issues, role-assumption failures, and authorization misconfigurations.

2. Cedar Policies at AgentCore Gateway

• Design, author, test, and deploy Cedar authorization policies using Amazon Bedrock AgentCore Policy.
• Implement fine-grained authorization for AI agents accessing tools through AgentCore Gateway.
• Define policies specifying which identities can invoke particular tools, APIs, and operations.
• Configure policy engines and associate them with AgentCore Gateways.
• Implement attribute-based access control (ABAC) using identity attributes, roles, scopes, and contextual conditions.
• Develop policies that restrict sensitive tool operations based on business roles, permissions, and security requirements.
• Validate Cedar policies against gateway schemas and test permitted and denied access scenarios.
• Enforce default-deny authorization and prevent unauthorized tool execution.
• Monitor and troubleshoot authorization decisions and policy evaluation failures.

3. Security Governance & Compliance

• Implement security controls for enterprise AI agents and Generative AI applications.
• Develop security standards for agent identities, API integrations, and access management.
• Support audit logging, access traceability, and security monitoring using AWS CloudTrail and CloudWatch.
• Identify and mitigate risks including excessive privileges, credential exposure, unauthorized tool access, and privilege escalation.
• Conduct security reviews of agent architecture and integrations.
• Collaborate with AI engineering and DevOps teams to ensure secure production deployments.

4. Security Automation & DevSecOps

• Automate security policy deployment through GitHub Actions and infrastructure-as-code pipelines.
• Integrate IAM and Cedar policy validation into CI/CD workflows.
• Implement automated security checks and policy compliance testing.
• Maintain version-controlled security configurations across development, testing, and production environments.
• Support security incident investigation, access troubleshooting, and remediation.

Required Technical Skills

• AWS Security: IAM, IAM roles, policies, STS, AWS Secrets Manager, CloudTrail, CloudWatch.
• Authorization: Cedar policy language, RBAC, ABAC, fine-grained access control.
• Infrastructure as Code: Terraform, AWS CDK, or CloudFormation.
• Automation: Python, GitHub Actions, CI/CD security integration.
• Cloud Security: Least-privilege access, identity federation, credential management, and secure API integrations.

All your information will be kept confidential according to EEO guidelines.